Toggle switch somewhere in the app so that when using an open WiFi network, all split tunnel apps are ignored so everything must use the VPN.

I add apps to split tunnel for compatibility reasons when on trusted networks but when on public WiFi I would rather these apps not work than allowing direct internet access on a potentially insecure network